Threat Investigation
Request a demo

CVE-2024-12054

Medium

Description

ZF Roll Stability Support Plus (RSSPlus) is vulnerable to an authentication bypass vulnerability targeting deterministic RSSPlus SecurityAccess service seeds, which may allow an attacker to remotely (proximal/adjacent with RF equipment or via pivot from J2497 telematics devices) call diagnostic functions intended for workshop or repair scenarios. This can impact system availability, potentially degrading performance or erasing software, however the vehicle remains in a safe vehicle state.

SeverityMedium
CVSS5.4
Exploit probability—
ProductRSSPlus 2M
PublishedFeb 13, 2025
First seenFeb 13, 2025
Weakness typeCWE-305CWE-305

How to fix

Update
  • ZF RSSPlus 2M01/23 or later

Affected products

ProductAffected versionsFixed in
ZF RSSPlus 2M01/08 ≤ v < 01/2301/23

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.